<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi George, <span style="caret-color:rgb(32, 31, 30);color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.666666984558105px;background-color:rgb(255, 255, 255);display:inline !important">Wouter,</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color:rgb(32, 31, 30);color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.666666984558105px;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color:rgb(32, 31, 30);color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.666666984558105px;background-color:rgb(255, 255, 255);display:inline !important">Thank
you for reply! The problem with this solution is that (even silently) unbound continue to contact blocked NS and as result load firewall filter significantly, as I mentioned before CPU load jumps to up to 50% and stays on this level till I reload unbound with
appropriate <span style="caret-color:rgb(0, 0, 0);color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);display:inline !important">do-not-query-address:.</span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color:rgb(32, 31, 30);color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.666666984558105px;background-color:rgb(255, 255, 255);display:inline !important"><span style="caret-color:rgb(0, 0, 0);color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color:rgb(32, 31, 30);color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.666666984558105px;background-color:rgb(255, 255, 255);display:inline !important"><span style="caret-color:rgb(0, 0, 0);color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);display:inline !important">Also
strange thing that unbound (it seems) does not have any limit of how many times tries to ping specific name server (I observed once 5 hours in a row).</span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color:rgb(32, 31, 30);color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.666666984558105px;background-color:rgb(255, 255, 255);display:inline !important"><span style="caret-color:rgb(0, 0, 0);color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color:rgb(32, 31, 30);color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.666666984558105px;background-color:rgb(255, 255, 255);display:inline !important"><span style="caret-color:rgb(0, 0, 0);color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);display:inline !important">Is
it (number of times to ping) configurable?</span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color:rgb(32, 31, 30);color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.666666984558105px;background-color:rgb(255, 255, 255);display:inline !important"><span style="caret-color:rgb(0, 0, 0);color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color:rgb(32, 31, 30);color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.666666984558105px;background-color:rgb(255, 255, 255);display:inline !important"><span style="caret-color:rgb(0, 0, 0);color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);display:inline !important">Thanks,</span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color:rgb(32, 31, 30);color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.666666984558105px;background-color:rgb(255, 255, 255);display:inline !important"><span style="caret-color:rgb(0, 0, 0);color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);display:inline !important">John</span></span></div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Unbound-users <unbound-users-bounces@lists.nlnetlabs.nl> on behalf of George Thessalonikefs via Unbound-users <unbound-users@lists.nlnetlabs.nl><br>
<b>Sent:</b> Monday, April 12, 2021 8:01 AM<br>
<b>To:</b> unbound-users@lists.nlnetlabs.nl <unbound-users@lists.nlnetlabs.nl><br>
<b>Subject:</b> Re: notice: send failed: Permission denied</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">Hi John,<br>
<br>
The error messages are coming from the system call itself, which your <br>
firewall seems to block. That way unbound will not record anything for <br>
the nameserver in the infra cache (used to record time outs among other <br>
options).<br>
This will result in unbound trying a finite number of times every time <br>
that nameserver needs to be contacted.<br>
<br>
If you lower the verbosity level to 2 (and with the fix I just committed <br>
<a href="https://github.com/NLnetLabs/unbound/commit/403d0551b7a65023e15be43ae5c1fd938edd6025">https://github.com/NLnetLabs/unbound/commit/403d0551b7a65023e15be43ae5c1fd938edd6025</a>)
<br>
you will no longer see log messages related to contacting upstreams.<br>
<br>
Unbound would still try to connect silently though before giving up.<br>
<br>
If you also want to skip that, then indeed using `do-not-query-address:` <br>
is the way to go.<br>
<br>
Best regards,<br>
-- George<br>
<br>
On 12/04/2021 11:20, Wouter Wijngaards via Unbound-users wrote:<br>
> Hi John,<br>
> <br>
> Fix code is in<br>
> <a href="https://github.com/NLnetLabs/unbound/commit/addd21f750b6042c40c2a92aef9b8919d8497532">
https://github.com/NLnetLabs/unbound/commit/addd21f750b6042c40c2a92aef9b8919d8497532</a><br>
> <br>
> This stops the logs messages unless you set a high verbosity level.<br>
> These error numbers did not get reported before, I guess because the<br>
> block rule is reject.<br>
> <br>
> Best regards, Wouter<br>
> <br>
> On 06/04/2021 03:48, Caroptions Caroptions via Unbound-users wrote:<br>
>> Important note, the firewall block rule is reject, not block ...<br>
>><br>
>> Thanks,<br>
>> John<br>
>><br>
>> ------------------------------------------------------------------------<br>
>> *From:* Unbound-users <unbound-users-bounces@lists.nlnetlabs.nl> on<br>
>> behalf of Caroptions Caroptions via Unbound-users<br>
>> <unbound-users@lists.nlnetlabs.nl><br>
>> *Sent:* Monday, April 5, 2021 2:20 PM<br>
>> *To:* unbound-users@lists.nlnetlabs.nl <unbound-users@lists.nlnetlabs.nl><br>
>> *Subject:* notice: send failed: Permission denied<br>
>> <br>
>> Hi,<br>
>><br>
>> Probably it is discussed already, then sorry for reiterating the same<br>
>> problem, but I couldn't find solution.<br>
>><br>
>> unbound 1.13.1<br>
>><br>
>> I block certain ASNs/IPs on firewall. unbound starts normally, then<br>
>> after some time flood log with messages:<br>
>><br>
>> unbound[90575]: [90575:2] notice: remote address is xx.xx.xx.xx port 53<br>
>> unbound[90575]: [90575:2] notice: send failed: Permission denied<br>
>> unbound[90575]: [90575:2] notice: remote address is xx.xx.xx.xx port 53<br>
>> unbound[90575]: [90575:2] notice: send failed: Permission denied<br>
>> unbound[90575]: [90575:2] notice: remote address is xx.xx.xx.xx port 53<br>
>> unbound[90575]: [90575:2] notice: send failed: Permission denied<br>
>> unbound[90575]: [90575:2] notice: remote address is xx.xx.xx.xx port 53<br>
>> unbound[90575]: [90575:2] notice: send failed: Permission denied<br>
>> unbound[90575]: [90575:2] notice: remote address is xx.xx.xx.xx port 53<br>
>><br>
>> the SAME ip for hours. My firewall process CPU load jumps and stays on<br>
>> high level. unbound process CPU load high as well.<br>
>><br>
>> My temporary workaround is adding:<br>
>><br>
>> do-not-query-address: xx.xx.xx.xx<br>
>><br>
>> When I add new ip to this list it stays normal for some time till<br>
>> unbound find new NS server IP which is blocked on firewall and all loads<br>
>> jumps and flood log with "notice" messages.<br>
>><br>
>> In my understanding unbound should stop attempting to contact specific<br>
>> NS if it is not reachable/down?<br>
>><br>
>> Thanks,<br>
>> John<br>
>><br>
>><br>
>><br>
</div>
</span></font></div>
</div>
</body>
</html>